Graffito
Notes written to bitcoin
Personal notes written into real bitcoin transactions, composed and signed on a device with no network. A companion page broadcasts and rescans the chain.
Last updated Aug 2026
Notebooks, one address each
Overview
Graffito turns your bitcoin address history into a notebook. You write a note on the device, which stays offline on purpose, and the app builds and signs a bitcoin transaction that carries it. Private notes are sealed with authenticated encryption before they leave the device; public notes go on-chain as plain text. Notes can be directed to any taproot address, to several recipients at once, and a directed note can carry a chosen amount of sats to each of them. Because everything lives on-chain, you can wipe the device, restore your seed, rescan, and every note comes back, private ones decrypted, with nothing stored anywhere else.
The device never touches the network. Sync bundles arrive by animated QR into the device camera, and signed transactions leave as a QR that the companion scans with a webcam, with files and the Airlock volume covering larger transfers. A hosted companion page is the only online half: it builds bundles from public chain data and broadcasts what the device signed, and it never sees a key. Everything written to the blockchain is public and permanent, including the transaction metadata around encrypted notes.
What it does
- Notebooks, each a distinct address derived from one device seed, with its own notes, balance, and name, and notes filterable by sender.
- Public or private notes: private ones sealed with authenticated encryption on-device, public ones plain text on-chain.
- Directed notes reach any taproot address, go to several recipients at once, and support reply and reply-all to keep a thread going.
- Composing starts at a contacts picker: yourself, nameable recent addresses, a QR scan, or manual entry.
- Directed notes can carry a chosen amount of sats to each recipient, from dust upward.
- A 24-word BIP-39 recovery phrase, shown as words or a SeedQR, restores a notebook’s funds in any bitcoin wallet and its notes in this app. Phrases are rotatable if one is ever exposed.
- Live per-keystroke cost with economy, normal, fast, or custom fee tiers, byte-exact against the signed transaction.
- Wallet-wide Coins screen with one-tap consolidate and a guided full-wallet sweep, each a single on-device signed transaction.
- Mainnet, testnet4, signet, and regtest as one wallet-wide setting, each notebook keeping a separate ledger per chain.
Technical breakdown
How the proof-of-concept is built, for developers evaluating the platform.
Air-gapped transport
The device stays offline by design. Sync bundles come in as animated QR read by the device camera, and signed transactions go out as a QR the companion scans with a webcam. Files and the Airlock volume handle the larger transfers, so the device and the companion exchange only files and QR codes, never keys.
A backup you can read
Notebooks derive from a 24-word BIP-39 recovery phrase the device shows on demand, as words or a SeedQR. Write it down once and the funds restore in any bitcoin wallet and the notes in this app, with no Passport required. Separate accounts keep separate lives, and a fresh phrase can replace one that is ever exposed.
Keys and encryption
Private notes are sealed with modern authenticated encryption before leaving the device. A Settings Dangerous area groups exports by risk: public (account xpub and a tr() descriptor, watch-only) and private (recovery words, and any notebook’s hex or WIF), each scannable as a QR. The device never shows a whole-account private key, since the 24 words already restore everything.
Dig into the source
README, architecture notes, and the wire protocol live in the repo.